Genesis::validate accepts a malformed eth_genesis_hash, so a genesis the loader accepts panics the node at startup

[erkancamli]

Genesis::validate (types/src/genesis.rs) checks every other genesis field but never eth_genesis_hash. Genesis::genesis_hash reads it with a double expect and documents it as "validated at load time", so a genesis with, for example, eth_genesis_hash = "0xdead" loads cleanly and the node panics at startup (bad eth_genesis_hash).

This contradicts three contracts the repo states:

• sendGenesis validates and atomically installs the file so startup does not risk "a crash loop", yet it installs this one and the node crash-loops on it.
• summit genesis digest says "anything this accepts a validator accepts", yet it prints a digest for this file.
• summit genesis set-validators re-parses its output to avoid "emitting a genesis no node can load", but copies the hash through unchecked.

Repro: load example_genesis.toml, set eth_genesis_hash = "0xdead", call validate(): it returns Ok, and genesis_hash() then panics.

Fix: reject a non-hex or non-32-byte value in validate, next to the existing treasury_address check. I have this ready with regression tests: they fail on main and pass with the fix, and summit-types (479), summit-rpc (22) and summit --lib (83) are green. Since external contributors can keep one PR open at a time, I'll open it once one of #458 / #460 / #461 is resolved, or sooner if you'd prefer.

[erkancamli]

One correction and one addition, checked on 5e59220.

The description says validate checks every other genesis field. That is too strong: it also never looks at validators, namespace or validator_minimum_stake.

Of those, validators has the same failure mode. A validator entry with a malformed consensus or node key (wrong length), ip_address or withdrawal_credentials passes from_toml_str, summit genesis digest and send_genesis, and then the node panics at node/src/args.rs:546 (get_validators().expect("Failed to get validators")). Once send_genesis has installed such a file it is treated as valid on every restart, so the node crash-loops, which the acquire_genesis doc says must not happen.

#450 already rejects duplicate and non-hex keys. Calling self.get_validators()? inside validate would cover the rest, and I am happy to fold that into the same fix with a test per field if you want it. The other two fields look harmless: namespace only feeds the deposit RPC domain and logs, and validator_minimum_stake is intentionally unbounded at runtime too.